Improper locking in Linux kernel

1) Improper locking

EUVDB-ID: #VU20807

Risk: Low

CVSSv3.1: 3.8 [CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-14763

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service attack (DoS) on the target system.

The vulnerability exists due to double-locking error in the DesignWare USB3 DRD Controller device in "drivers/usb/dwc3/gadget.c". An authenticated local user with physical access to the system can exploit this vulnerability to cause a deadlock with "f_hid", resulting in a denial of service condition.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Linux kernel: 4.16 - 4.16.3

External links

http://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.16.4
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=072684e8c58d17e853f8e8b9f6d9ce2e58d2b036
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=c91815b596245fd7da349ecc43c8def670d2269e
http://github.com/torvalds/linux/commit/072684e8c58d17e853f8e8b9f6d9ce2e58d2b036
http://github.com/torvalds/linux/commit/c91815b596245fd7da349ecc43c8def670d2269e

Q & A

Can this vulnerability be exploited remotely?

No. The attacker should have physical access to the system in order to successfully exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.